Questionnaire section 4
- 0 answers, each with its evidence; 0 labelled as intention.
- Evidence cited: 0.
AI governance, security and trust
Answers that show their evidence
A fluent answer that cannot show where it came from is a risk, not a help.
Demonstration: Aldercroft Facilities Services (fictional) · Facilities management. Fictional data and a scripted answer.
The situation
- Organisation
- Aldercroft Facilities Services (fictional)
- Who is asking
- Sales engineer completing a customer security questionnaire
- Industry
- Facilities management
- What happened
- A prospect has sent a 60-question security questionnaire, and some answers are easy to write but cannot be evidenced.
The question asked
Which answers to this section of the questionnaire can we give, with evidence, and which must we not?
What it reads, and who can see the result
- Questionnaire section documentThe questions asked.
- Evidence library registerPolicies, records and reports the company holds.
- Reads
- The questions and the evidence library's index.
- Does not read
- The sensitive detail of evidence beyond what an answer needs.
- Permission
- The sales engineer's access to approved evidence.
- Who sees it
- The sales engineer, the security lead and the prospect on release.
Try it
Choose which statements go into the brief. A statement with no source is refused; each one you include carries its sources with it.
Questionnaire response: section 4, operations
Choose the statements to include. Each one carries its sources into the brief.
0 of 6 statements included · 1 held back for lack of a source.
The answer
Simulated answer. Written for this fictional case, not produced by a live model. Only the figures in it are computed, from what you decided above.
0 answers are ready to give with evidence; 1 was refused because nothing proves it.
Each answer in the response carries the record it rests on [S1][S2][S3]. The claim that all data is encrypted everywhere is a natural thing to write and cannot be shown from what the company holds, so it is not given: an unsupported 'yes' to a security question becomes a commitment.
The plan for an independent assessment is stated as an intention and labelled an estimate. The right answer to a question you cannot evidence is a precise 'not yet', with what is in place.
Relies on: S1 · Information security policy v4S2 · Access review record, last quarterS3 · Backup restore test record
Review and approval
The security lead decides. Approving releases this section of answers to the prospect as the company's response. It does not assert any certification or assessment the company does not hold.
Not ready to approve. Choose at least one supported statement for the brief first.
In the product this is a different person with the right permission. Here you play that role to see the rule.
What it produces
Answer trace
- Each answer lists the record it rests on; one answer without evidence was withheld.
Limits of this example
- An answer is only as good as the record behind it.
- Evidence shown to a prospect may need a confidentiality agreement.
- This is a scripted demonstration on fictional data. No model was called and no real organisation, person or result is shown.
More in AI governance, security and trust
- A Trust and Security area for customersSecurity and procurement teams ask the same questions again and again, and the answers are scattered.
- Govern the AI your organisation usesTeams adopt AI tools faster than anyone records them, who approved them or what they may touch.
- Permissions, approvals and an audit trailWhen something goes wrong, nobody can say who could do what, who approved it and when.
- Retention, holds and where work is processedRecords are kept too long or deleted too soon, and nobody can show why.
The AI governance, security and trust story · This capability in the full register